News

A huge web security flaw dropped today. Here's what it means for your money

Everyday Banking · October 21, 2026

If a website you use is down for maintenance this week, this could be one reason.

Earlier today, the people who maintain PHP released an emergency update. PHP is one of the oldest and most widely used tools for building websites. It quietly powers a huge share of the internet, from small online shops and blogs to bill-pay portals and member login pages. Most people have never heard of it, and that's kind of the point. It just runs in the background.

Today, two serious flaws in it went public. Here's the short version, in plain words.

What actually happened

Security researchers found two bugs in PHP that, under the right conditions, let an attacker take control of a website's server by sending it one specially crafted request. No password. No login. Just one request.

The two bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and some people online are calling them "php2shell." The PHP team shipped fixes today in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Versions 8.1 and older are past end of life and won't get regular releases. Sites still on them need a fix from their hosting vendor or an upgrade.

The U.S. Cybersecurity and Infrastructure Security Agency, better known as CISA, put out an alert telling organizations to patch immediately. As of its alert, CISA said it hadn't seen anyone using the bugs in real attacks yet. Europe's cybersecurity team, CERT-EU, noted that early proof-of-concept code has begun to circulate, which it said raises the likelihood that attackers are already exploiting the flaws.

So the race is on. CISA told organizations that can't update right away to take PHP-based systems offline until they can, so some sites may go down for a bit.

Why this matters for your money

This isn't a flaw in your card or your bank account. It's in software that many websites run on.

The bigger question is everything around your money:

Small online stores. Lots of independent shops run on PHP-based tools like WordPress with WooCommerce, or Magento, if their PHP isn't updated.
Bill-pay and invoice portals. The page where you pay a utility, a doctor's office, or a contractor might be built on PHP.
Smaller services and membership sites. Plenty of login and payment pages run on PHP somewhere behind the scenes.

If one of those sites doesn't get updated in time, an attacker who takes it over could do things like quietly copy card numbers as people type them at checkout, or redirect visitors to a fake page. That's the real-world risk for regular people.

And there's a second wave to expect. Whenever a big security story hits the news, scammers jump on it. Don't be surprised if you see emails or texts this week saying something like "Due to a security update, please re-verify your card." That's exactly the kind of message to be suspicious of.

What you can do (it's not much, and that's good news)

You don't need to install or patch anything yourself. This is a website-owner problem. But a few small habits go a long way this week:

Don't re-enter your card because a message told you to. If you get a "security update" or "verify your account" email or text, don't tap the link. Go to the site or app yourself, the way you normally would.
Know how your card protects you. Under federal law, credit cards generally come with stronger protections against fraudulent charges than debit cards. With debit, the money can be missing from your checking account while a dispute is sorted out. The FTC explains the difference here.
Glance at your statements. Skim your recent card and bank activity over the next few weeks. If something looks off, call the number on the back of your card.
Be patient with maintenance pages. A site that's down for an update may be patching.

If you run a website

If you have a website, even a small one, reach out to your web host today and ask whether your PHP has been updated to one of the fixed versions. If you're on PHP 8.1 or older, ask about a vendor fix or upgrading, because those versions are past end of life. The PHP Foundation's write-up has more detail for the technical folks.

If you don't have a website, you're mostly a spectator on this one. Keep an eye out for those "re-verify your card" messages.

Everyday Banking™ is a read-only companion for seeing your own accounts in one place. It doesn't hold or move your money.

Sources: CISA alert, October 21, 2026, CERT-EU advisory 2026-018, PHP Foundation, October 21, 2026